US agencies say Iran-linked actors are disrupting water and energy control systems

CISA, the FBI, NSA, EPA, and Department of Energy updated a joint advisory warning that Iran-affiliated actors are exploiting internet-facing operational technology across US critical infrastructure, and in some cases disrupting it. Since at least March 2026 the group has targeted programmable logic controllers, the small industrial computers that run automation processes, extracting device project files and then modifying or deleting the control logic. Water, wastewater, energy, and government facilities are among the affected sectors, and some victims experienced operational disruption and financial loss. The July update broadened the range of affected device makers, added detection guidance, and refreshed the published indicators of compromise.

Check

Take internet-facing PLCs and operational technology offline or behind a VPN, change default and weak device passwords, and check for unexpected changes to control logic and project files.

Affected

Water, wastewater, energy, and government operators with internet-exposed programmable logic controllers; attackers extract project files and alter control logic, which can push processes into unsafe states.

Fix

Remove operational technology from direct internet exposure, enforce strong unique credentials and multi-factor authentication, segment control networks, back up device logic offline, and apply the advisory's detection guidance and indicators.